PT-2021-14362 · Jquery+1 · Jquery-Validation+1

Alvaro Muñoz + 1 · Published 2021-01-13 · Updated 2023-08-31 · CVE-2021-21252

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: jquery-validation versions prior to 1.19.3

Description: The issue concerns the jQuery Validation Plugin, which provides drop-in validation for existing forms. It contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This vulnerability was discovered and reported by GitHub team member Erik Krogh Kristensen.

Recommendations: For versions prior to 1.19.3, update to version 1.19.3 to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable regular expressions until a patch is applied.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-21252

DLA-3551-1

GHSA-JXWX-85VP-GVWM

Affected Products

Debian

Jquery-Validation

References · 20

• https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7d · Patch
• https://github.com/jquery-validation/jquery-validation/pull/2371 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21252 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21252 · Security Note
• https://ubuntu.com/security/CVE-2021-21252 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3551-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21252 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-21252 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21252 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21252 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jxwx-85vp-gvwm · Vendor Advisory
• https://github.com/jquery-validation/jquery-validation · Note
• https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm · Note
• https://github.com/phpmyadmin/phpmyadmin/commit/401eedd288c4e83d69287b97a9f574f231156171 · Note
• https://securitylab.github.com/advisories/GHSL-2020-294-redos-jquery-validation · Note